So here's a legal question: let's say you get a credit card from BigBadBank, and one of the terms in their 30-page agreement is that you agree to allow the bank to provide your personal information to third parties in order to verify your credit worthiness or to offer other services to you (i.e., cross-marketing). You are of course deemed to have agreed to those terms by using the credit card. I'll bet that there are no terms in that agreement restricting what private personal information the bank can provide, who they can provide it to, or requiring them to use any measures to protect your personal data. If they have a duty of care, it is imposed by other laws, not by their own agreement.

Now if one of those 3rd parties like Equifax carelessly leaks that personal information, who do you sue? Most obviously Equifax, but most people probably have no direct connection with Equifax at all. There is no contract between you. Equifax obtained information about you from their own sources. Do they have any duty of care to you not to expose it on the internet?

So maybe you sue BigBadBank, since there is a contract between you and they have a duty of care with respect to your private information, whether they leak it or give it to a third party who leaks it. But BigBadBank will may say that lots of sources gave information to Equifax. How are you going to prove that it's their fault?

So here's a legal question: let's say you get a credit card from BigBadBank, and one of the terms in their 30-page agreement is that you agree to allow the bank to provide your personal information to third parties in order to verify your credit worthiness or to offer other services to you (i.e., cross-marketing). You are of course deemed to have agreed to those terms by using the credit card. I'll bet that there are no terms in that agreement restricting what private personal information the bank can provide, who they can provide it to, or requiring them to use any measures to protect your personal data. If they have a duty of care, it is imposed by other laws, not by their own agreement.

Now if one of those 3rd parties like Equifax carelessly leaks that personal information, who do you sue? Most obviously Equifax, but most people probably have no direct connection with Equifax at all. There is no contract between you. Equifax obtained information about you from their own sources. Do they have any duty of care to you not to expose it on the internet?

So maybe you sue BigBadBank, since there is a contract between you and they have a duty of care with respect to your private information, whether they leak it or give it to a third party who leaks it. But BigBadBank will may say that lots of sources gave information to Equifax. How are you going to prove that it's their fault?

The problem is KYC legislation most likely mandates that they collect all of this data and pass it around so they can sniff you out. In a decentralized financial system, the customer will have absolute control over their information and deal with transactions on a much more level playing field. Contracts won't be shrouded in mystery.

In a perfect system, corporations would fear the government and the government would fear the people. - David Wong

I am actively trying to get 'unbanked' through crypto. It is taking some time, but I figure in 10 years I will have no use for a bank or a credit reporting agency.

There are problems with crypto too. Its way too complicated to catch on in its current form, and I suspect it too will be hacked at some point, it's not a stable medium of exchange (but a good speculative investment), its also fiat, I'm sure I can come up with more but that will do. I'd like to stick with cash or precious metals once I deal with my housing issue, and just buy stuff. This Equifax thing is particularly grading as I don't ever borrow money (except CC) yet they still end up with my information. Hell, even the banks will do a credit check even if all I'm doing is making a deposit or setting up an account. I still have a credit card but plan to get rid of that at some point as well.

"On some great and glorious day the plain folks of the land will reach their heart's desire at last and the White House will be adorned by a downright moron.” -HL Mencken

I'll bet that there are no terms in that agreement restricting what private personal information the bank can provide, who they can provide it to, or requiring them to use any measures to protect your personal data. If they have a duty of care, it is imposed by other laws, not by their own agreement.

I think we will learn about a lot of things once this goes through the privacy commissioner.
Anybody remember the hoopla about police departments uploading presumed information onto CPIC that was then passed onto homeland security?

We already know that three senior execs were likely insider trading when they sold nearly $2M of stock in a non-scheduled sale prior to the new being public.

New suspicious activity around put trades prior to the information going public. Someone purchased about $150K in put options on the stock a week before the announcements, which after the stock dropped was a profit of about $4M for them

Jon Najarian, a trader and CNBC contributor, said Equifax options trade infrequently. As an example, in the entire month of July, Equifax put options traded just under 260 contracts, or about 13 contracts a day.

But Aug. 21 was different. Najarian pointed to activity in Equifax puts that day, when 10 times as many were bought than in the entire preceding month.

Specifically, Najarian said, 2,600 contracts, giving the owner the right to sell 260,000 shares of Equifax at $135 in September, were purchased for 60 to 70 cents each.

You authorized the banks to report your personal info and account status (payment, balance, etc.) to the credit bureaus (compiling a credit history) when you opened a bank/credit card account with them.

We already know that three senior execs were likely insider trading when they sold nearly $2M of stock in a non-scheduled sale prior to the new being public.

New suspicious activity around put trades prior to the information going public. Someone purchased about $150K in put options on the stock a week before the announcements, which after the stock dropped was a profit of about $4M for them